PT-2021-15720 · WordPress · Database Backup

0Xb9 · Published 2021-04-05 · Updated 2021-12-03 · CVE-2021-24174

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Database Backups WordPress plugin versions prior to 1.2.2.7

Description: The issue allows attackers to perform unwanted actions on a logged-in user's account, such as generating database backups, changing plugin settings, and deleting backups, due to the lack of CSRF checks.

Recommendations: For Database Backups WordPress plugin versions prior to 1.2.2.7, update to version 1.2.2.7 or later to resolve the issue.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2021-24174

Affected Products

Database Backup

References · 5

• 🔥 http://packetstormsecurity.com/files/163091/WordPress-Database-Backups-1.2.2.6-Cross-Site-Request-Forgery.html · Exploit
• 🔥 https://exploit-db.com/exploits/49984 · Exploit
• https://osv.dev/vulnerability/CVE-2021-24174 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24174 · Security Note
• https://wpscan.com/vulnerability/350c3e9a-bcc2-486a-90e6-d1dc13ce1bd5 · Note